CVE-2026-114082
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
- State
- Published
- Severity
- 7.2 High
- Published
- Oct 21, 2026
- Updated
- Oct 22, 2026
- Reserved
- Oct 20, 2026
Description
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
trigger.devtriggerdotdev |
|
References
- GitHub Security Advisory (GHSA-cpx8-cffg-mp4w)vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentialsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.